I have an entirely separate VLAN network in my house for "appliances". Any access to the internet from that network has to be explicitly whitelisted in my router.